RatOn Hijacks Bank Account to Launch Automated Money Transfers

According to ThreatFabric, RatOn is a mobile banking trojan developed from scratch by a threat actor group observed since July 2025, and it combines traditional overlay attacks with NFC relay tactics to hijack bank accounts and initiate automated money transfers through a bank app interface. The initial access vector involves malicious “TikTok18+” themed domains hosting a dropper APK, with victims who grant installation from unknown sources receiving a WebView-based installer that side-loads a second-stage payload.

Once installed, RatOn asks for Accessibility and Device Administrator privileges to automate UI interactions, enabling it to monitor the foreground app, relay screen content to its command server, and intercept PIN entries. Its ATS module can navigate a Czech bank’s app—specifically “George Česko”—to perform transfers, entering stolen PINs and routing money to mule accounts, with indications of collaboration in the Czech Republic and potentially Slovakia.

In addition to fiat transfers, RatOn targets four cryptocurrency wallets, exposing recovery phrases via its UI automation and keylogger components. RatOn’s capabilities also include live screen streaming, push-notification spoofing, and device locking as part of its broad command set.